ML20129H901
| ML20129H901 | |
| Person / Time | |
|---|---|
| Site: | McGuire, Mcguire  |
| Issue date: | 05/17/1985 |
| From: | Chiramal M NRC OFFICE FOR ANALYSIS & EVALUATION OF OPERATIONAL DATA (AEOD) |
| To: | |
| Shared Package | |
| ML20129H896 | List: |
| References | |
| TASK-AE, TASK-E507 AEOD-E507, NUDOCS 8506070689 | |
| Download: ML20129H901 (9) | |
Text
-
p AE0D' ENGINEERING EVALUATION REPORT UNIT:
McGuire 1 and 2 EE REPORT N0: AE0D/E507 DOCKET NOS: 50-369 and 50-370 DATE: May 17, 1985 LICENSEE:
Duke Power Company EVALUATOR / CONTACT:
M. Chiramal NSSS:
SUBJECT:
ELECTRICAL INTERACTION BETWEEN UNITS DURING.
LOSS OF 0FFSITE POWER EVENT OF AUGUST 21, 1984 EVENT DATE: August 21, 1984
REFERENCE:
Duke Power Co., LER 50-369/84-024 and LER 50-370/84-020
SUMMARY
This report provides the review and evaluation of an event that occurred at the McGuire Station on August 21, 1984.
The event was initiated by a problem at the station's switchyard computer system which led to the tripping of several breakers in the Unit 1 and Unit 2 switchyards. Unit I was opera-ting at 100% power and Unit 2 was starting up at the time of the event.
Unit I lost all of its offsite power and tripped. The unit's onsite emergency diesel generators started up and loaded the safety-related buses as required.
Unit 2 tripped shortly after Unit 1 due to problems in the plant's common auxiliary control power supply system. The event was complicated by several failures that occurred as a result of voltage surges that were experienced during the event and some random component failures.
The operators, however, had safe control of both units all through the event.
The report concludes that had the two units been operating at full power, the event could have been more complicated.
It also concludes that at nuclear plant sites with multiple units, events initiating at one unit can propagate and involve more than one unit due to problems associated with systems that are common to the units.
The report recommends that the details of this event, with emphasis on the potential problems associated with common auxiliary systems, be included in a forthcoming issue of Power Reactor Events for feedback purpose.
INTRODUCTION On August 21,1984 at 9:48 p.m., McGuire Unit i experienced loss of offsite power and tripped. At 10:25 p.m., McGuire Unit 2 also tripped. Unit I was operating at 100% power and Unit 2 was in Mode 3 in the process of starting up.
- This report supports ongoing AE0D and NRC activities and does not represent the position or requirements of the responsible NRC Program Offices.
g,
. The loss of Unit 1230 kV offsite power was initiated by a malfunction of the McGuire switchyard computer system when the system was being returned to service following corrective maintenance. The malfunction caused all but eignt 230 kV and 525 kV switchyard power circuit breakers (PCBs) to open simultaneously.
The eight PCBs that remained closed were PCB 8, 9, 11, 12, 58, 59, 61 and 62 (see FSAR Figure 8.2.1-10).
At this point, all Unit 1 generator output was concer trated on two 230 kV transmission lines which l
tripped 17 seconds later on overcurrent resulting in total loss of the 230 kV switchyard power supply.
(The two 525 kV lines feeding Unit 2 switchyard remainedunaffected.)
Upon loss of offsite power, a Unit i reactor trip occurred on Nuclear Instrumentation Power Range High Flux Rate signal.
This was followed by a turbine trip.
The turbine speed and generator frequency started decreasing causing reactor coolant pumps trips on underfrequency and generator breakers trips on volts / hertz relay operation.
On the ensuing undervoltage conditions on the 4160V buses, diesel generators DG-1 A and DG-1B started and sequenced on the loads as designed.
Fifty seconds after Unit I reactor and turbine trip, letdown was isolated due to spuricus low level on Channel Il pressurizer level as a result of a voltage spike. This caused pressurizer pressure and level increase when both charging pumps were loaded on to the DG buses.
Seven minutes after the trip, charging flow was reduced and letdown re-established.
Steam pressure peaked at approximately 1150 psig after the trip.
Steam pressure was initially controlled by steam dump to the condenser.
After the steam dump valves closed, steam pressure continued to decrease because of the high steam demand (Unit 1 was supplying the auxiliary steam require-ments for both units at the time of the trip) and the high auxiliary feedwater flows needed to recover level.
Steam pressure reached a minimum of 735 psig when ope'rators manually isolated main steam. Approximately 40 minutes after the trip, offsite power was restored to the unit and two reactik coolant pumps were started.
Unit I had been supplying auxiliary steam to Unit 2.
On Unit 1 trip, the Unit 2 operators realizing that the supply of steam to operate the unit's feedwater pump turbines was limited, initiated the start-up of the auxiliary steam boiler. At 9:52 p.m., a low main feedwater pump discharge pressure alarm was received. At this time, the operators noticed that the Unit 2 main steam isolation valves (MSIVs) were closed, apparently due to the power interruptions caused by Unit I trip.
Operators took manual control of main steam power operated relief valves (PORVs) for steam pressure control.
When pres.4re in steam generator (SG) 2C reached 1140 psig, relief valve 2SV-9 opened.
However, the operators were not aware that the relief valve had opened (the relief valve's set point was 1190 psig).
The valve reseated after four minutes and during this period steam pressure in SG-2C decreased to approximately 1100 psig and water level decreased by approximately 5%.
At 10:15 p.m., the operators started the motor driven auxiliary feedwater
9 pumps with their discharge valves throttled to prevent shocking the steam generators. At 10:16 p.m., the relief valve 2SV-9 reopened and remained
- open for approximately 10 minutes.
(Again, the operators were not aware of the relief valve's condition -- the operation of the relief valve was identified later during the review of the alarm typewriter printout and transientmonitordata.)
The open relief valve caused pressure and level decrease which the operators tried to compensate by increasing auxiliary feedwater flow to SG-2C. At approximately 10:25 p.m., the relief valve reseated and SG-2C low-low level caused a reactor trip.
After the trip, steam pressure was stabilized and SG levels were controlled at the no-load level set point by the auxiliary feedwater system.
DISCUSSION McGuire Unit 1 When offsite power was lost in Unit I switchyard, the Unit I reactor tripped on Nuclear Instrumentation (NI) Power Range High Flux Rate signal. The trip-point for this signal is an excore power increase of greater than 5% in two seconds on two out of four channels. A review of plant parameters by the licensee could not find evidence of an actual reactivity increase which caused the NI Power Range High Flux Rate Trip.
A review of the excore chart recorders indicated power range spike on all four power range channels, with two channels reaching the trip set point. The licensee has concluded after reviewing oscillographs and transient monitor data, that the spike in the channels was due to the voltage transient caused by the opening of the last switchyard breaker.
The NI Power Range High Flux Rate Trip was immediately followed by Steam Generator Low-Low Level Reactor Trips.
Hence, it can be seen that in this case, the loss of offsite power transient would have led to a reactor trip even if the initial spurious high flux rate trip had not occurred.
The reactor trip was followed by the consequential turbine trip.
Following the trips, decreasing turbine speed and frequency led to the generator trip on the volts / hertz protection; trip of the reactor coolant pumps; undervoltage conditions on the unit's on-site electrical buses (6900, 4160 and 480 Volts); and initiation of the blackout logic.
The main generator carried the house load for approximately 40 seconds after the reactor and turbine trip. When blackout logic was initiated, both diesel generators were started and assumed the sequenced on loads as designed.
Upon reactor trip, pressurizer pressure dropped from 2230 psig to approximately 2030 psig and pressurizer level fell from 61% to 38%.
Pressare recovered to 2235 psig as pressurizer level increased when the charging pumps sequenced on the diesel generators. Letdown isolation
6-y 4-valve, INV-IA and orifice outlet valve, INV-458, closed on spurious low level on pressurizer level Channel II caused by a voltage spike.
The isolation signal also de-energized the pressurizer heaters. Level reached a post-trip maximum ofm46% at which time charging flow was decreased-and level decreased to around the no-load level of 25%.
The pressurizer pressure control was manually controlled and charging flow reduced.approximately seven minutes after reactor trip. Pressurizer pressure began decreasing to the post-trip minimum of 1954 psig. Once the low level alann was reset, the operators were able to re-energize the backu'p pressurizer heaters (m25 minutes after the trip).
Pressurizer pressure remained below the PORV setpoint of 2335 psig and above the safety injection setpoint of 1845 psig throughout the event.
Thus, except for the spurious actuation of pressurizer level Channel II, pressurizer level and pressure control functioned as required.
Reactor Coolant System hot leg temperature dropped immediately after the reactor trip as heat production decreased and steam was relieved through the steam dump valves to the condenser.
Hot-leg temperatures started to rise again when the reactor coolant pumps tripped and natural circulation developed. Core JLT stabilized between 35' and 40*F, as expected for natural circulation.
Both hot and cold leg tempera-tures decreated as the steam pressure decreased. Minimum average coolant temperature reached wase530*F. The primary temperature decrease was within the 100*F/ hour technical specifications limit.
Steam pressure reachedwll50 psig after the trip (below the setpoint of 1170 psig of the first bank of safety valves). The steam pressure was initially controlled by dumping steam via the steam dump valves to
- the condenser. These valves all closed 40 seconds after the trip.
Steam pressure continued to decrease because of the high steam demand (Unit I was supplying the steam requirements of both Unit I and Unit 2 at the time of the trip), and the high auxiliary feedwater flows needed to recover SG level. Steam pressure reached a minimum of ;35 psig at 10:10 p.m. when the operator manually isolated main steam.
The steam generator PORVs on SGs A. C and D had been isolated prior to the trip because of leakage. At-10:12 p.m., the operators unisolated all SG PORVs and subsequently used them to control steam pressure.
SG level dropped toe 55% at the time of the trip due to the closure of the turbine governor valves.
All four low-low level reactor trip signals came in shortly after the initial reactor trip on Power Range High Flux Rate. All three auxiliary feedwater pumps came on. When load shed occurred later, the motor driven auxiliary feedwater pumps tripped off and restarted 10 seconds later on the DG buses. The operators secured the turbine driven AFW pump at #9:58 p.m.
The AFW flow was adjusted by the operators to maintain the no load level of 38%.
i
-erm-o,w~-
-,-ew~n m
e-
=
w
- e
,m-w w----m,--r-ww
,--m-
+,
w
---w
--*ww-e-*-----m--g e-w-
.-memr
+ - - - - -
-,ww-me--ggps---
.m
r b
i i
At#9:49 p.m., the 2 out of 3 undervoltage logic for 4160 V buses ETA and ETB was satisfied and this blackout logic initiated both diesel jl generators and corresponding load shed and load sequencing. All loads were on the diesel within 15 seconds of the blackout logic actuation.
2 L
Containment ventilation isolated atw 9:50 p.m. when circuit breakers associated with certain radiation monitors of Units 1 and 2 tripped.
This was caused apparently by a problem associated with the 125 Vdc/120
.Vac Auxiliary Control Power System -- specifically, with 120 Vac auxiliary power panel board KXA supplied by inverter KXA connected to
[
125 Vdc distribution center DCA. During the electrical disturbance that initiated the-loss of offsite power, the panel board KXA apparently
'~
I transferred back and forth between the static inverter KXA and the l
alternate supply MKA, leading to blowing of the output fuses of the j
inverter and trip of Units 1 and 2 radiation monitor cabinet circuit breakers.
The trip of these circuit breakers caused the de-energiza-tion of containment particulate, iodine and gas monitors f6r Units 1
_and 2, which caused containment ventilation isolation. When power was restored to 120 Vac panelboard KXA (via the alternate supply MKA),
i these breakers were reset and no other problems were experienced.
The breakers tripped apparently due to voltage surges.
McGuire Unit 2
~
The loss of panelboard KXA also caused the Main Steam Isolation Valves of Unit 2 to close.
(MSIVs 2SM-1, 2SM-3, 2SM-5 and 2SM-7 closed as a result of the de-energization of the solenoid valves associated with them.) At 9:52 p.m., the control room received a low main feedwater pump disenarge alarm. After noting that the main steam isolation valves had closed, the operators took manual control of the main steam l
PORVs and started to equalize pressure across the MSIVs. The isolation i
valves were later opened. When the pressure in SG 2C reached 1142 psig j
(at approximately 10:00 p.m.), relief valve 2SV-9 opened prematurely (its setpoint being 1190 psig).
The opening of the relief valve went undetected by the operator.
(Although the digital computer alanned i
and typed on the alarm typer, the alarm point does not appear on the video screen and, hence, could go undetected by the operator.) The relief valve reseated after 4 minutes and reopened again at 10:16 p.m.
for approximately 10 minutes.
The operators were preparing to start the AFW pumps on Unit 2 with the discharge valves throttled to reduce l
shock to the SGs. When the relief valve opened, SG 2C started to lose level rapidly leading to a reactor trip on low-low SG level at 10:25 p.m.
Following reactor trip, AFW valves to all four steam generators opened 4 -
to their automatic open position on the automatic signal. The AFW l
control was taken in the manual mode, and the SG levels were control-l led at the no-load level.
The reactor trip caused the insertion of control rod shutdown banks A and B which were withdrawn at that time.
Pressurizer pressure remained at approximately its reference value all during the event. Maximum l
reactor coolant T average was 563*F and minimum was 560'F. The minimum pressurizer level reached was approximately 30%. Letdown was not isolated and safety injection was not actuated on Unit 2.
- - a_ - - - -. -, - -.,
. The licensee has initiated corrective actions to prevent recurrence of the event.
The majority of these actions are focused at the switchyard computer system and the offsite power system operation and maintenance activities.
During the event, Unit 2 did not lose offsite power. However, had Unit 2 been operating at power during the loss of offsite power and trip of Unit 1, a Unit 2 trip would have occurred when MSIVs on Unit 2 closed due to loss of 120 Vac panelboard KXA.
(The MSIVs closure would have caused low steam generator level trip of Unit 2.)
It is also possible that if Unit 2 had been operating at power, then the initial switchyard computer system problem could have caused a loss of offsite power at the 525 kV Unit 2 switchyard also.
(The computer system problem would have concentrated Unit 2 output to just two 525 kV transmission lines which could have tripped on overcurrent, just as Unit 1 lines had.)
The above two possibilities show that problems in auxiliary systems that are common to both units at the McGuire Station, such as Switchyard Computer System and 125 Vdc/120 Vac Auxiliary Control Power System, can lead to transients and events that affect both units concurrently. The plant operators should be made aware of the possible effects and consequences of l
such problems in these auxiliary systems so that they can adequately cope with situations in which both units are simultaneously affected. A detailed failure modes and effects analysis of these common systems should be per-formed to address all the possible consequences.
The event also involved several simultaneous failures due to a canmon-cause failure mechanism -- voltage surge. The first failure identified as caused by voltage surge / spike is the spurious Unit I reactor trip due to NI Power Range High Flux Rate Trip.
Although only two channels of instrumentation tripped, a later review of the excore chart recorder indicated power range spikes o.n all four power range channels. This trip occurred at 9:48:46 p.m.
The following four failures occurred more or less simultaneously at 9:49:34 p.m.:
- 1) Loss of power to radiation monitor cabinets of both units leading to containment ventilation isolation of both units.
- 2) Loss of Static Inverter KXA.
3)
Loss of control power to Unit 2 MSIV solenoids leading to main steam line isolation.
- 4) Unit 1 Pressurizer Level Channel 11 failure leading to letdown isolation and trip of pressurizer heaters.
The first three failures above are associated with problems caused by voltage surge in the 125 Vdc/120 Vac Control Power System.
The fourth item, the failure of a pressurizer level chanr.21, is a separate independent failure, apparently caused by the same voltage surge.
9
- FINDINGS AND CONCLUSIONS Based on review of the event that occurred at the McGuire Station on August 21, 1984, the following findings were obtained:
1.
Unit I suffered a loss of all its offsite power (230 kV) due to problems associated with the McGuire Station switchyard computer system.
Unit 2 switchyard (525 kV) was also affected, but did not lose all of its 525 kV transmission lines and, hence, did not lose all of its offsite power supply. Unit I was at 100% power and Unit 2 was starting up when the event occurred.
2.
Following the loss of offsite power, Unit 1 tripped on a spurious NI Power Range High Flux Rate trip, closely followed by a Low Steam Generator Level trip. On the consequent loss of Unit 1 onsite power supply, the black-out sequence initiated and the unit's two diesel generators started and sequenced on the required loads as designed.
3.
Voltage surges apparently caused spurious actuation of instrumentation channels and problems with the station's auxiliary control power system which led to:
a)
Unit 1 letdown isolation and pressurizer heater trip.
b)
Containment ventilation isolation of both units.
c)
Loss of inverter KXA.
d)
Unit 2 MSIVs closure.
These problems did not seriously hamper the safe shutdown of Unit 1 or Unit 2.
4.
Unit 2 tripped on low steam generator level approximately 27 minut'es after Unit 1 trip. Unit 2 trip was caused mainly by the premature actuation of a steam line safety relief valve without the operators being aware of it.
A contributing factor was the loss of steam supply from Unit I to the feed-water pumps of Unit 2.
Following the unit trip and subsequent feedwater system isolation, the unit was maintained in a safe shutdown condition with the auxiliary feedwater system and the steam generator PORVs.
5.
Unit 2 did not lose its 525 kV offsite power system.
6.
Some corrective actions have been taken and others have been planned by the licensee to prevent recurrence of the switchyard problems which initiated this event.
O O
. The review concludes the following:
1.
Problems associated with the station switchyard computer system, which is common to both units, initiated the event tnat led to total loss of offsite power to Unit 1 and trip of several circuit breakers in the Unit 2 switchyard.
2.
Problems in another common system, the 125 Vdc/120 Vac Auxiliary Control Power System, caused complications to the transient experienced by both units -- complications such as closing of Unit 2 MSIVs, isolation of containment ventilation of both units, and loss of inverter KXA and its consequences.
3.
Voltage spikes caused by switching surges caused several failures and spurious actuations which also added to the complexity of the event.
One voltage surge was associated with the actuation of the switchyard 230 kV and 525 kV breakers and another set, later into the event, associated with the actuation of onsite system breakers (such as the 6900 V, 4160 V and 480 V breakers).
4.
Had both Units 1 and 2 been operating at full power, then the initiating switchyard computer system problem could have led to total loss of offsite power and trip of both units.
This would have added to the complexity of the event and to the control room operators' task of bringing both units to a safe and stable shutdown condition.
5.
Nuclear plants that have multiple units at one s'te have the potential for similar complicated events propagating from one unit to another due to the auxiliary systems that are shared by, or common to, the units.
(Examples of such systems at McGuire are switchyard computer system and 125 Vdc/120 Vac Auxiliary Control Power Supplies System.)
6.
During the event and following the closure of MSIVs on Unit 2, a safety relief valve prematurely actuated a couple of times without the operators being aware of its operation. Had the operators known of the opening of the valve, adequate corrective actions may have been taken by the operators to prevent the low steam generator trip of the unit.
Although the opening of the relief valve was alarmed and printed on the alarm typer, this information is intended only for post trip evaluation, and thus, was undetected by the operator during the event.
l SUGGESTION j
Although the event at the McGuire Station involved the loss of offsite power and trip of one unit, the trip of a second unit, and several failures of systems and components due to voltage surges, the plant operators i
- 1
o 6
-9_
capably operated both units safely. Had both units been operating at full power, the event could potentially have been more complicated.
Since conplicated events of this type have the potential for occurring at nuclear stations with multiple units, it is recommended that the details of this event, with emphasis on the problems that occurred in systems that were common to both units, be included in a forthcoming issue of Power Reactor Events.
The event should alert the licensees of operating reactors for the need to review the failure modes and effects of the plants' auxiliary systems which are shared by, or common to, more than one unit; and based on tne review, the plant operators should be made aware of the potential for any event at one unit becoming complicated and propagating to other units due to the problems associated with such auxiliary systems.
-,